HN user

ctz

2,856 karma

bluesky: https://bsky.app/jbp.io

mastodon: https://infosec.exchange/@ctz

github: https://github.com/ctz/

locale: Cambridge, England

alumnus: nCipher, Thales eSecurity, Good Technology, Blackberry, Electric Imp, Twilio

recent open source:

- rustls: a TLS stack in Rust

- fastpbkdf2: faster PBKDF2

Posts26
Comments473
View on HN
bluejekyll.github.io 2y ago

Hickory DNS

ctz
74pts14
connect.electricimp.com 7y ago

Air quality monitoring with Slack

ctz
1pts0
c2rust.com 8y ago

C2rust translates most C modules into semantically equivalent Rust code

ctz
6pts0
www.youtube.com 9y ago

Why Quantum Computers Cannot Work I – Prof. Gil Kalai

ctz
3pts1
www.ietf.org 9y ago

Barriers to Entry

ctz
4pts0
www.openssl.org 9y ago

OpenSSL Security Advisory - 26 Sep 2016

ctz
126pts36
shubs.io 9y ago

High frequency security bug hunting: 120 days, 120 bugs

ctz
129pts24
groups.google.com 10y ago

Proposed limited exception to SHA-1 issuance

ctz
2pts0
www.stephenfry.com 10y ago

Too many people have peed in the pool

ctz
694pts511
jbp.io 10y ago

Using SGX to harden password hashing

ctz
6pts0
googleonlinesecurity.blogspot.com 10y ago

Proactive measures in digital certificate security

ctz
39pts6
jbp.io 10y ago

Abusing U2F to 'store' keys

ctz
2pts0
cynosureprime.blogspot.com 10y ago

How we cracked millions of Ashley Madison passwords

ctz
372pts166
dspace.mit.edu 11y ago

Keys Under Doormats: Mandating Insecurity

ctz
2pts0
tools.ietf.org 11y ago

The Harmful Consequences of Postel's Maxim

ctz
65pts32
jbp.io 11y ago

Benchmarking Modern Authenticated Encryption on €1 Devices

ctz
3pts0
www.scientificamerican.com 11y ago

How Transparency Will Change the World

ctz
1pts0
www.isg.rhul.ac.uk 11y ago

Attacks Only Get Better: Password Recovery Attacks Against RC4 in TLS

ctz
52pts5
jbp.io 11y ago

Libotr: the code review

ctz
1pts0
jbp.io 12y ago

How to monetise the IoT through energy markets

ctz
4pts0
www.longitudeprize.org 12y ago

The Longitude Prize 2014

ctz
4pts0
secure-resumption.com 12y ago

Triple Handshakes: Breaking and Fixing Authentication over TLS

ctz
3pts0
jbp.io 12y ago

Analysis of the OpenSSL random API

ctz
7pts0
jbp.io 12y ago

Guessing the Android SecureRandom vulnerability

ctz
1pts0
jbp.io 13y ago

You shouldn't put all your eggs into the TLS forward secrecy basket

ctz
4pts0
flashover.ifihada.com 14y ago

Show HN: Flashover - online flash decompiler

ctz
2pts1

I have a Neato D650 which I assume meets that classification and is covered by the service withdrawal, it is now pretty degraded -- no notifications, no mapping, no keep-out zones.

No notifications means if it gets stuck it stays there.

No mapping means if it doesn't fully clean the space (eg, a door is closed) then I have no way of knowing without baby-sitting it.

No keep-out zones means every clean involves carefully preparing the space to hang up trailing wires out of the way -- previously I just had some keep-outs near the wires and that worked perfectly.

Without all these features I have stopped using it; it is quicker to just use a stick vacuum.

The other base64 prefix to look out for is `MI`. `MI` is common to every ASN.1 DER encoded object (all public and private keys in standard encodings, all certificates, all CRLs) because overwhelmingly every object is a `SEQUENCE` (0x30 tag byte) followed by a length introducer (top nibble 0x8). `MII` is very very common, because it introduces a `SEQUENCE` with a two byte length.

It is instructive to compare Bun and Deno's issue tracker. Like, the five most recent issues for Bun at the time of writing are all crashes. Some of these are controlled panics or assertion failures, but others are like "we are now executing from address -1" or "we are trying to read from address 0x00000069." Recently written software simply should not have these classes of problem.

The topic is how to make non-local returns faster. I would suggest that normal returns are massively faster, and not returning at all is faster still (zero instructions needed!) -- but neither of these are non-local returns.

  Runtime errors surface when a program
  runs into an unexpected condition or situation
  such as dividing by zero, memory overflow, or
  addressing a wrong or unauthorized memory
  location or device, or when a program tries to
  perform an illegitimate or unauthorized operation
  or tries to access a library, for example.
  The programs must be thoroughly tested for
  various types of inputs (valid data sets, invalid
  data sets and boundary value data sets) and
  conditions to identify these errors. Once identified,
  runtime errors are easy to fix.
Embarrassing horseshit.

I believe AIX C++ name mangling includes function argument type information (with CV qualifiers!) so this is a real-world case where this does actually break. I suspect curl does not compile with the C++ compiler though.

Interning in Go 2 years ago

Lots of small strings sparsely spread over 282MB is pretty cache inefficient?

Whereas the separate small allocations will likely end up close together, which gives a better chance that a given cache line will contain several rather than just one.

It makes sense once you realise that Chrome and Google benefit from increasing the complexity of web browsers. It means that new browsers cannot feasibly compete. It's basically an arms race of "how much mental shit can we throw in there"?

Why it’s not removed: backward compatibility I bet.

I mean, in the intervening period there was OpenSSL 3 which was a large backwards-incompatible (API and ABI) release, with a huge amount of effort on the part of OpenSSL developers and users to follow along. It was the ideal opportunity to drop this sort of old stuff.

The underlying concept is applicable to lots of things, really. For example, the functions that are unsafe and safe to call from a POSIX signal handler can be treated as a function colouring problem.